Windows Subsystem for Linux: Link following leads to local privilege escalation
Summary
Improper link resolution before file access (CWE-59) in Windows Subsystem for Linux (WSL2) allows a local user with low privileges to elevate privileges. The CNA record reports a CVSS 3.1 score of 7.8 with high impact on confidentiality, integrity and availability, and elevation to SYSTEM is reported. An attacker needs an existing local account on the affected machine and no user interaction; the flaw is not reachable from the internet. Shared PCs and developer workstations with WSL are most exposed.
Affected
- Microsoft Windows Subsystem for Linux (WSL2) according to the CNA record: "5.0.0.0" to less than 3.0.1
- The lower bound 5.0.0.0 appears to be a data error and is not confirmed. Verify the affected range on the MSRC advisory.
Fixed in
- Version 3.0.1 according to the CNA record and one secondary source; not yet confirmed on the MSRC advisory.
- Latest release at the time of research: WSL 3.0.4 (released 17 October 2026).
Workaround
Unknown. No workaround was found in the sources; patching is the fix.
Exploitation
- Publication day (13 October): VulDB rated exploitation as easy, technical details unknown, no public exploit.
- RadioCSIRT reports a CISA KEV addition on 20 October; this is not verified against the KEV catalogue.
- CISA SSVC assessment in the CNA record: exploitation none, automatable no.
- No public proof of concept found. Treat as possibly exploited until the KEV entry is checked.
Our recommendation
- Inventory all WSL installations and their versions on client endpoints.
- Install the latest WSL version as recommended by Microsoft, and confirm the fixed build on the MSRC advisory.
- Prioritise developer workstations, shared PCs and multi-user systems.
- Before patching, export the diagnostic information from the WSL administration screen and check for signs of prior misuse if compromise is suspected.
- Check the CISA KEV catalogue for CVE-2026-102204 and monitor for further advisories.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-102204 msrc.microsoft.com
- Vulners CVE List record: CVE-2026-102204 vulners.com
- VulDB: CVE-2026-102204 vuldb.com
- RadioCSIRT newsletter 69 radiocsirtenglishedition.substack.com
- Wilders Security: Microsoft October/November security updates www.wilderssecurity.com
- Versio: Windows Subsystem for Linux release information www.versio.io
- The Windows Update: CVE-2026-102204 thewindowsupdate.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:16.
Original description (NVD)
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.